Critical Prompt Injection in Claude Code Opus 5 Auto Mode Allows Malicious Code Execution

Key Takeaways

• A critical prompt injection vulnerability has been discovered in Anthropic’s Claude Code Opus 5 in Auto Mode.
• This flaw enables malicious code execution through a seemingly benign website summary request.
• Despite previous assurances from Anthropic regarding the mode’s prompt injection resistance, new research demonstrates successful bypasses with multi-step attacks.
• The vulnerability highlights the need for robust sandboxing and monitoring when utilizing autonomous coding agents, even with built-in safety features.

Anthropic’s Claude Code Opus 5, when operating in its “Auto Mode,” has been found susceptible to critical prompt injection attacks that can lead to arbitrary code execution. Researchers demonstrated that a simple request to summarize a website could be weaponized to run malicious code, achieving success rates between 60% and 80% in controlled laboratory tests.

This discovery from Embrace The Red is particularly noteworthy because Anthropic had previously reported a 0.00% prompt injection success rate for Opus 5 Auto Mode across a defined set of test scenarios. The new research, however, reveals that sophisticated, multi-stage attack methodologies can circumvent these automated defenses.

Claude Code Auto Mode is designed to streamline user interaction by reducing the need for constant approval prompts. It employs an internal safety classifier to evaluate tool calls, which Anthropic presented as a more secure alternative to completely bypassing permissions. However, the company also clarified that this feature is not intended to replace comprehensive sandbox environments or operating system-level security controls.

Claude Code Opus 5 Auto Mode Hijacked

The attack sequence commenced with a seemingly innocuous command: summarizing a website. This website, controlled by the attacker, appeared to host an archive of notebook records. When Claude attempted to use its built-in web-fetching tool, the server intentionally responded with an HTTP 415 error.

In response to the error, Claude independently decided to use the curl command via its shell interface to directly retrieve the website’s content. The malicious website then redirected this request to a ZIP archive. This archive contained various files, including catalog entries, encoded records, a legitimate-looking decoder binary, and a critical component of the attack: a malicious Python file named struct.py.

Claude correctly identified and refused to execute the untrusted native decoder binary included in the archive. Ironically, this seemingly secure decision inadvertently paved the way for the subsequent, more subtle stage of the attack.

Instead of running the provided binary, Claude proceeded to write its own Python decoder to process the encoded files. This custom decoder legitimately imported standard Python modules such as base64, zlib, and json. Crucially, Claude executed this self-generated decoder from within the extracted ZIP directory.

Python’s module loading mechanism prioritizes the current working directory when searching for modules. The attacker exploited this by naming their malicious file struct.py, effectively “shadowing” Python’s legitimate standard-library struct module. Consequently, when Claude’s decoder imported base64, Python’s internal dependency resolution eventually led to the loading of the attacker-controlled struct.py file.

This malicious struct.py was designed to execute arbitrary code during its import process, all while allowing the legitimate decoder functionality to proceed undisturbed. As a result, Claude successfully processed and received valid decoded records, remaining unaware that a hidden payload had already been executed in the background.

In the proof-of-concept, the compromised Python module initiated a separate, isolated Python process. This child process then downloaded and executed a more advanced payload, established a command-and-control (C2) callback, and visibly launched the Calculator application as an overt indicator of compromise.

The researcher also explored an alternative attack vector, where the malicious module launched another instance of Claude Code in a headless mode. This nested agent reportedly conducted basic system reconnaissance, opened Calculator, and successfully wrote files outside the confines of its initial workspace.

These test results, based on small sample sizes, showed consistent success rates. The Python-based attack chain succeeded in 3 out of 5 tests (60%). The variant involving a nested Claude Code instance also achieved success in 3 out of 5 tests. A version that wrote files outside the workspace proved even more effective, succeeding in 4 out of 5 tests (80%).

According to Embrace The Red, the primary takeaway from this research is that Auto Mode should not be considered a definitive security boundary. While a classifier might deem a short command harmless, it may fail to fully grasp the intricate risks embedded within an archive, a local import path, a spawned child process, or a network request.

What You Should Do

• Organizations deploying autonomous coding agents should always operate them within strictly isolated environments, such as containers, virtual machines, or dedicated test systems.
• Implement stringent network access controls, limiting agents’ ability to communicate with external resources unless explicitly necessary.
• Prevent agents from accessing or running code from untrusted directories and sensitive credential stores.
• Maintain continuous monitoring of agent processes for anomalous behavior, unexpected network connections, or unauthorized file system modifications.
• While Auto Mode can enhance usability by reducing prompt fatigue and may be safer than disabling approvals entirely, comprehensive sandboxing and diligent monitoring remain indispensable when agents interact with untrusted websites, archives, or code repositories.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.